Archive for November 29, 2021

Passwords That Won’t Keep You Safe

These Passwords Won't Keep You Safe OnlineI could not let 2021 wrap up without the annual look at the OMG WTF are they thinking worst passwords list. I have been covering the sorry-state of passwords since 2010 and unfortunately little has changed. The biggest change has come in the increased number of mega-breaches leaking passwords all over the Intertubes.

Nordpass logoHere is NordPass’s 2021 list. Nordpass and independent cybersecurity researchers evaluated a database with 4 terabytes’ worth of data. You can visit the NordPass website to see all 200 of the entries from 2021. But here are the top 25 most common passwords:

2021's Worst Passwords

2021's 25 worst passwords compiled by Nordpass.
RankPasswordChange from 2020
1123456-
2123456789-
312345+5
4qwerty+8
5password(1)
612345678-+1
7111111(2)
8123123(2)
91234567890(1)
101234567+1
11qwerty123New
12000000+3
131q2w3eNew
14aa12345678New
15abc123(2)
16password1+3
171234(1)
18qwertyuiop+6
19123321+4
20password123New
211q2w3e4r5tNew
22iloveyou(5)
23654321+1
24666666New
25987654321New

Bad password factoids

  • The top 25 bad passwords can be cracked in less than 1 second by a bot (or person) according to Nordpass.
  • different types of passwords94% of the most frequent passwords – can be cracked in less than 10 seconds
  • The most secure password “myspace1” ranked #54 on the list. It was used by 1,619,027 users and can be cracked in 3 hours.
  • The most popular sport on the list is “football.” It ranked #60 and was used by 1,468,381 users.
  • Superman” protected 1,180,436 accounts. He ranked 81st but could be cracked in less than 1 second.
  • The most popular movie on the list was “starwars.” 701,474 users tried to use the Force to protect their accounts. Unfortunately the Force is not strong with this one, it could be cracked in less than 1 second.

Password risk index

The NordPass researchers also devised a risk index based on the number of passwords leaked in each country per capitaRussia came in first with an astounding 19.9 passwords leaked per capita. Other counties that leaked the most passwords are:

  • The Czech Republic 6.2,
  • France 6.0,
  • Germany 5.8,
  • U.S. 5.2,
  • Italy 4.4,
  • Canada 3.6,
  • Australia3.3
  • and Poland 3.6.

rb-

You can test the strength of your password by visiting this site and typing it in. They claim the site isn’t creating a repository of passwords because your information is never sent over an internet connection. The best part? As you type, the software tells you approximately how long it would take a computer to figure out your password. The site turns red if your password is weak but slowly turns green as you make it stronger. It’ll even give you tips on how to improve your password security.

 

Stay safe out there!

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

GoDaddy WordPress Sites Hacked?

GoDaddy WordPress Sites Hacked?GoDaddy (GDDY), the world’s largest domain name registrar, disclosed that it had been hacked. According to reports on Monday (11/22/2021), an unknown attacker gained unauthorized access to the system used to provision the company’s Managed WordPress sites. This breach impacts up to 1.2 million GoDaddy WordPress customers. This number does not include the number of customers of websites affected by this breach.

GoDaddy logoThe company posted, We are sincerely sorry for this incident and the concern it causes for our customers,” “We, GoDaddy leadership and employees, take our responsibility to protect our customers’ data very seriously and never want to let them down.

GoDaddy resellers also compromised

On Tuesday (11/23/2021), GoDaddy confirmed that some of their resellers were also compromised in the attack. If you purchased your WordPress domains from

Assume your WordPress site has been compromised.

According to the SEC report filed by the Scottsdale, AZ-based firm, the attacker gained access via a compromised password on September 6, 2021. The attacker was discovered on November 17, 2021, when the attacker’s access was revoked. The attacker had more than two months to establish persistence, so anyone currently using GoDaddy’s Managed WordPress product should assume compromise until they can confirm that is not the case.

What happened at GoDaddy?

credentials in cleartextSeveral sites are reporting that GoDaddy stored sFTP (Secure FTP) credentials so that the plaintext versions of the passwords could be retrieved, rather than storing salted hashes of these passwords or providing public key authentication, which is industry best practice. This decision allowed an attacker direct access to password credentials without cracking them. According to their SEC filing: “For active customers, sFTP and database usernames and passwords were exposed.”

What did the attacker have access to?

The SEC filing indicates that the attacker had access to:

  • User email addresses,
  • Customer numbers,
  • Original WordPress Admin password that was set at the time of provisioning,
  • SSL private key and
  • sFTP and database usernames and passwords.

What could an attacker do with this info?

The attackers had unrestricted access to these systems for over two months. During that time, they could have:

  • Secure FTPThey have taken over these sites by uploading malware or adding a malicious administrative user. This allows them to maintain persistence and retain control of the sites even after the passwords are changed.
  • The attacker would have had access to sensitive information, including website customer PII (personally identifiable information) stored on the impacted sites’ databases.
  • Sometimes, an attacker could set up a man-in-the-middle (MITM) attack that intercepts encrypted traffic between a site visitor and an affected site.
  • The exposed email addresses and customer numbers cause increased phishing risks.

How to resecure your GoDaddy host WordPress site

GoDaddy should be notifying impacted customers. In the meantime, experts recommend that all Managed WordPress users assume that they have been breached and perform the following actions:

  1. If you run an e-commerce site or store PII (personally identifiable information) and GoDaddy verifies that you have been breached, you may be required to notify your customers of the breach.
  2. Change passwordsChange all of your WordPress passwords.
  3. Force a password reset for your WordPress users or customers.
  4. Change any reused passwords and advise your users or customers to do so. 
  5. Enable 2-factor authentication wherever possible. 
  6. Check your site for unauthorized administrator accounts.
  7. Scan your site for malware using a security scanner.
  8. Check your site’s filesystem, including wp-content/plugins and wp-content/mu-plugins, for any unexpected plugins or plugins that do not appear in the plugins menu.
  9. Be on the lookout for suspicious emails.

rb-

These GoDaddy data breaches are likely to have far-reaching consequences. GoDaddy’s Managed WordPress offering makes up a significant portion of the WordPress ecosystem, affecting site owners and their customers. The SEC filing says that “up to 1.2 million active and inactive Managed WordPress customers” were affected. Customers of those sites are most likely also affected, which makes the number of affected people much larger.


Stay safe out there!

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Thanksgiving 2021

Thanksgiving

It’s not just for turkey…

Thanksgiving 2021

Happy Pumpkin Pie Day

 

Stay safe out there!

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

14 Tips to Impress on Your Next Video Call

14 Tips and Tricks to Impress on Your Next Video CallVideo calls won’t be going away any time soon. Despite companies eyeing “return to the office” initiatives remote work is here to stay. The new normal distributed workforce will continue to use video conferencing to support workplace collaboration. It is estimated that by 2025, 36.2 million Americans will be working remotely. That represents an 87% percent increase from pre-COVID-19 levels. U.S, businesses have more than 11 million video meetings a day Here is a list of things you can do to improve your effectiveness during your next video call.

Before the video call

1. Dress Appropriately – You want to appear professional. Wear attire that’s appropriate for the type of meeting. This doesn’t mean you need to wear a suit. Assess the situation and dress to match it.

Be Prepared2. Be Prepared – Before attending an online meeting, prepare yourself mentally. This helps you take part more effectively. This also includes preparing materials you may need. This is even more important if you are presenting or need to go through some documents with the team.

Join the video conference

3. Arrive Early – Arriving early helps you get settled in and ready to begin. You’ll have time for small talk, which can help you connect with others. Arriving early also provides additional time to review any documents or presentations prior to beginning the session.

Position the camera4. Frame Yourself – Position the camera to be straight in front of you or slightly higher. Don’t have the camera off to the side or below you. Sit close enough so that you’re in the middle of the frame. Fill at least one-third of the screen. If you sit too far away, you’ll appear small on the camera.

5. Clean Your Background – Look at what’s behind you and what others will see when you’re on camera. Don’t show a room full of dirty laundry or stacks of clutter. Use the virtual backgrounds available in Zoom and Microsoft Teams.  And make sure others in your home know that you’ll be on video to avoid any potentially embarrassing situations.

Don’t sit with a bright light behind you6. Light Up – When you’re using a webcam, avoid direct sunlight because this can be too harsh. Don’t sit with a bright light behind you because it will be hard for others to see your face. Also avoid bright or harsh overhead lights. They wash out skin tones. Instead, choose soft lighting that lets others easily see your facial expressions.

During the video call

7. Turn the Camera On – Many feel strongly video conference participants should leave their camera on during meetings. When you turn your camera off it is considered a sign of disrespect to everyone else in the meeting.

sit up straight8. Sit Straight – Your posture should reflect confidence and strength. Do not hunch over your laptop. Keep your shoulders back and head upright. You’ll definitely look better on video calls if you sit up straight. Sitting up straight will help you be more energized while on the video call. Slouching can make you look unmotivated and lazy.

9. Look at the Camera – Eye contact conveys interest and engagement. When speaking, look at your camera so that it gives the impression of making eye contact with those you’re speaking to.

Use common courtesy in the call

10. Pay Attention – Remain focused throughout the entire meeting. That means avoid multitasking. Multitasking takes your focus away from what’s happening in the meeting. The best way to avoid multitasking is to mute your phone. Incoming calls, texts, emails, and social media notifications disturb you as well as other stakeholders.

11. Speak Clearly – Speaking loudly may seem appropriate when communicating face-to-face, but it doesn’t work well over distance. Try using clear language and short sentences.

11. Don’t Interrupt – It’s rude. Interrupting makes it difficult for speakers to finish sharing their thoughts. Instead, Ask Relevant Questionswait until they finish speaking before responding.

12. Ask Relevant Questions –  It shows that you’re engaged and paying attention. Even if you have nothing else to say in a meeting, asking a question gives you the chance to take part and get noticed.

13. Don’t Gossip – Be respectful of others. Even if you’re having a more casual meeting, spreading gossip makes you look unprofessional and will decrease others’ trust in you.

14. Stay Positive – Being negative does nothing to help anyone’s mood. Instead, focus on solutions rather than problems.

rb-
Using these tips can help you appear more confident and elevate your presence in virtual meetings. This can help you get noticed, and others will take you more seriously at work. And they’ll help you build relationships that can help your career.

 

Stay safe out there!

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

McAfee Can’t Stay Out of the News

McAfee Cant Stay Out of the NewsLess than 6 months after John McAfee was found dead in his Spanish jail cell, the anti malware company that still bears his name is back in the news. The anti-malware and internet security firm, McAfee announced Monday (11/08/2021) that it had reached an agreement to be bought. The McAfee has been bought by a global investor group in a deal worth more than $14 billion.

McAfee logoMcAfee will move forward as a privately held company. The new firm will be a pure consumer cybersecurity play. McAfee has 20 million subscribers for its security services globally.

McAfee investors

The global investor group is made up of Advent International Corp., Permira Advisors, Crosspoint Capital Partners, Canada Pension Plan Investment Board, GIC Private Limited and a wholly owned subsidiary of the Abu Dhabi Investment Authority.

A billion dollar here and a billion thereMcAfee sold it’s Enterprise business in July, 2021 for $4.50 a share to Symphony Technology Group. The sale equaled $4 billion.

The move takes the publicly-traded company private again after the initial public offering of McAfee by Intel and TPG last year.

rb-

Confused? I don’t. blame you. The firm has a history of changing.

  • 1987 to 1997 – The company was founded as and known as McAfee Associates, Inc.
  • 1997 to 2004 – Network Associates Inc.
  • 2004 to 2014 –  Renamed back to McAfee Associates, Inc.
  • 2014 to 2017 –  The company was part of the Intel Security Group.
  • 2017 to 2020  – The firm was spun out of Intel and renamed McAfee.
  • I don't. blame you2020 – McAfee goes public again with a $740 million IPO on Nasdaq under ticker symbol MCFE. This marked its return to the public market after 9 years.
  • 2021 – McAfee sold it’s Enterprise business to Symphony Technology Group for $4 billion.
  • 2021 – McAfee sold it’s consumer business to an investor group in a deal worth more than $14 billion.

 

Stay safe out there!

 

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.